CVE-2021-28918
2 advisories.
npm/netmask CVE-2021-28918, CVE-2021-29418: critical 9.1, EPSS 16.66%
Improper parsing of octal bytes in netmask
Action: Upgrade netmask to 1.1.0 or later.
npm i netmask@1.1.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.0 | - |
Fixed versions
| 1.1.0 |
Sources
- osv: GHSA-4c7m-wxvm-r7gc
- https://nvd.nist.gov/vuln/detail/CVE-2021-28918
- https://github.com/advisories/GHSA-pch5-whg9-qr2r
- https://github.com/rs/node-netmask
- https://github.com/rs/node-netmask/blob/98294cb20695f2c6c36219a4fbcd4744fb8d0682/CHANGELOG.md#v110-mar-18-2021
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
- https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects
- https://security.netapp.com/advisory/ntap-20210528-0010
- https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications
- https://www.npmjs.com/package/netmask
CVE-2021-28918, CVE-2021-29418 · published · modified · JSON
npm/netmask CVE-2021-28918, CVE-2021-29418: medium 5.3, EPSS 16.66%
netmask npm package mishandles octal input data
Action: Upgrade netmask to 2.0.1 or later.
npm i netmask@2.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.1 | - |
Fixed versions
| 2.0.1 |
Sources
- osv: GHSA-pch5-whg9-qr2r
- https://nvd.nist.gov/vuln/detail/CVE-2021-29418
- https://github.com/rs/node-netmask/commit/3f19a056c4eb808ea4a29f234274c67bc5a848f4
- https://security.netapp.com/advisory/ntap-20210604-0001
- https://sick.codes/sick-2021-011
- https://sick.codes/universal-netmask-npm-package-used-by-270000-projects-vulnerable-to-octal-input-data-server-side-request-forgery-remote-file-inclusion-local-file-inclusion-and-more-cve-2021-28918
- https://vuln.ryotak.me/advisories/6
- https://www.npmjs.com/package/netmask
CVE-2021-28918, CVE-2021-29418 · published · modified · JSON